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What. is claimed is : 

1 1. A method of processing and storing data in a 

2 computer system including processor circuitry, and a data 

3 storage device, the method comprising the steps of: 

4 storing first and second sets of records in 

5 separate first-in, first-out data structures, 

6 respectively, on the data storage device, the first and 

7 second sets of records being of different data 

8 resolutions and corresponding to overlapping periods of 

9 time; 

10 operating the processor circuitry to receive 

11 data collected over a period of time; and 

12 operating the processor circuitry to update, ir 

13 parallel, at least one record in each of the stored first 

14 . and second sets of records with the received data such 

15 that a previous record included in each of the first and 

16 second data structures is replaced. 

1 3. The method of claim 1, further comprising the step 

2 of: 

3 allocating fixed amounts of storage space on 

4 the data storage device for storing each one of the firs 

5 and second first-in, first-out data structures used to 

6 store the first and second sets of records. 

1 4. The method of claim 1, wherein the first set of 

2 records include hourly records and the second set of 

3 records includes daily records. 
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1 5. The method of claim 1, further comprising the step 

2 of : 

3 periodically collecting network traffic data; 

4 storing the collected network traffic data in a 

5 buffer; and 

6 operating the processor circuitry to retrieve 

7 network traffic data from the buffer, the retrieved 

8 network traffic data being received by the processor 

9 circuitry. 

1 6- The method of claim 5, 

2 wherein the network traffic data stored in the 

3 buffer includes time stamp information indicating the 

4 period of time in which the network traffic data was 

5 collected; and 

6 wherein the step of operating the processor 

7 circuitry to update at least one record in each of the 

8 stored first and second sets of records includes the step 

9 of: 

10 examining at least one time stamp included in 

11 the buffered network traffic data. 

1 7, A method of processing and storing data in a 

2 computer system including processor circuitry, and a data 

3 storage device, the method comprising the steps of: 

4 storing first and second sets of records in 

5 separate first-in, first-out data structures, 

6 respectively, on the data storage device, the first and 

7 second sets of records being of different data 
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g resolutions and corresponding to overlapping periods of 

9 time; 

10 operating the processor circuitry to receive 

11 data collected over a period of time; and 

12 operating the processor circuitry to update at 

13 least one record in each of the stored first and second 

14 sets of records with the received data such that a 

15 previous record included in each of the first and second 

16 data structures is replaced; 

17 periodically collecting network traffic data, 

18 wherein the collected network traffic data includes byte 

19 and packet count information associated with each of a 

20 plurality of monitored conversations between devices 

21 included in the computer system; 

22 storing the collected network traffic data in a 

23 buffer; and 

24 operating the processor circuitry to retrieve 

25 network traffic data from the buffer, the retrieved 

26 network traffic data being received by the processor 

27 circuitry; 

28 wherein the step of operating the processor 

29 circuitry to update at least one record in each of the 

30 stored first and second sets of records includes the 

31 steps of: 

32 updating a record corresponding to a first 

33 conversation in the first set of records; and 

34 updating a record corresponding to the first 

35 conversation in the second set of records. 
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1 8. The method of claim 5, 

2 wherein the processor circuitry includes first 

3 and second central processing units, and 

4 wherein the step of operating the processor 

5 circuitry to update at least one record in each of the 

6 stored first and second sets of records includes the step 

7 of operating the first processor to update the first set 

8 of records while operating the second processor to update 

9 the second set of records, 

1 9. The method of claim 1, 

2 wherein the processor circuitry includes first 

3 and second central processing units, and 

4 wherein the step of operating the processor 

5 circuitry to update at least one record in each of the 

6 stored first and second sets of records includes the step 

7 of operating the first processor to update the first set 

8 of records while operating the second processor to update 

9 the second set of records. 



1 10. The method of claim 5, wherein the computer system 

2 further includes a display device, the method further 

3 comprising the step of: 

4 displaying data corresponding to overlapping 

5 periods of time at different resolutions on the display 

6 device - 
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1 11. The method of claim 1, further comprising the step 

2 of : 

3 allocating storage space for storing the first 

4 and second sets of records in the first and second 

5 first-in, first-out data structures, respectively. 

1 12. A method of collecting and processing network 

2 traffic data, comprising the steps of: 

3 periodically collecting network traffic data 

4 from a data probe, 

5 generating a database of network traffic 

6 information from the collected network traffic data, the 

7 database comprising a plurality of network traffic data 

8 sets of differing degrees of data resolution 

9 corresponding to overlapping network traffic time 
10 periods, 

1, storing each of the plurality of network traffic 

12 data sets in a different first-in, first-out data 

13 structure wherein a limited amount of data storage space 

14 is used for each of the different first-in, first out 

15 data structures, 

16 updating, in parallel, at least one record in the 

17 different first-in, first-out data structures with the 

18 collected network traffic data, and 

19 overwriting the oldest data records in the 

20 first-in, first-out data structure used to store one of 

21 the network traffic data sets, when the limited amount of 

22 data storage space used for said first-in, first-out data 

23 structure is filled with records. 
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1 13. The method of claim 12, wherein the differing 

2 degrees of resolution correspond to measurement time 

3 periods of different duration. 

1 14. The method of claim 12, 

2 wherein the collected network traffic data 

3 includes a plurality of traffic data counter values; and 

4 wherein each traffic data counter value in the 

5 collected network traffic data includes information 

6 corresponding to an individual monitored conversation, 

7 the step of generating a database including the step of 

8 generating from the information on each different 

9 monitored conversation, a different record in each set of 

10 the plurality of network traffic data sets. 

1 17 . A system for monitoring network traffic data, 

2 comprising: 

3 a plurality of network traffic data probes for 

4 collecting network traffic information; 

5 processor circuitry coupled to the network 

6 traffic probes for receiving data therefrom; and 

7 a data storage device for storing a network 

8 traffic database generated by the processor circuitry 

9 using data collected by the network traffic data probes, 

10 the data storage device including: 

11 a plurality of data structures, each data 

12 structure being a first-in, first-out data structure, 

13 each one of the plurality of data structures including 

14 network traffic data: 
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a) stored at a different resolution than the 
resolution at which network traffic data is stored in the 
other ones of the plurality of data structures; and 

b) corresponding to a period of time which overlaps 
the period of time for which network traffic data is 
Stored in the other ones of the plurality of data 



21 structures; 



means for updating, in parallel, at least one record 
in the different first~in, first-out data structures with 
the collected network traffic data, and 

means for overwriting the oldest data records in the 
first-in, first-out data structure used to store one of 
the network traffic data sets, when the limited amount of 
data storage space used for said first-in, first-out data 
structure is filled with records. 



1 19. The system of claim 17, wherein each one of the 

2 plurality of data structures includes a plurality of data 

3 records, each data record corresponding to a monitored 

4 network conversation. 

1 20. The system of claim 17, wherein data records are 

2 arranged within each individual data structure as a 

3 function of the time the conversation to which the record 

4 corresponds was monitored. 

1 21. The system of claim 20, wherein records which were 

2 monitored during the same time interval are grouped 

3 together within each individual data structure. 
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1 22. The system of claim 21, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 

5 an individual network conversation. 

1 23. The system of claim 17, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 

5 an individual network conversation. 

1 24. The system of claim 17, wherein the processor 

2 circuitry includes a plurality of separate central 

3 processing units which operate in parallel. 

1 25. The system of claim 24, wherein each one of the 

2 plurality of data structures includes a plurality of data 

3 records, each data record corresponding to a monitored 

4 network conversation. 

1 26. The system of claim 24, wherein data records are 

2 arranged within each individual data structure as a 

3 function of the time the conversation to which the record 

4 corresponds was monitored. 

1 27. The system of claim 26, wherein records which were 

2 monitored during the same time interval are grouped 

3 together within each individual data structure. 
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1 28. The system of claim 27, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 

5 an individual network conversation. 

1 29. The system of claim 24, further comprising: 

2 means for modifying at least one network 
traffic data record included in each one of the plurality 
of data structures to reflect collected information about 



3 
4 



5 an individual network conversation. 
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